CVE-2026-118235: RCE in SimpleForm WordPress Plugin

Critical RCE in SimpleForm for WordPress: arbitrary file upload by unauthenticated users up to v.3.10.2

CVE-2026-118235 is an arbitrary file upload vulnerability in the SimpleForm plugin for WordPress, affecting versions up to 3.10.2. The flaw resides in the handle_upload function, which lacks a server-side file extension allowlist and does not properly sanitize file extension derivation. Unauthenticated attackers can bypass all validations using trailing-dot filenames, enabling upload of executable files that lead to remote code execution (RCE) on the WordPress server.

The vulnerability scores CVSS 9.8 and is classified Critical. Risk is maximum because access control relies solely on a nonce printed publicly in the data-nonce attribute of every form embedded via shortcode, making it trivially obtainable by any visitor. CVE-2026-118235 was published by NVD on 2026-10-31. Four posts about this flaw have been recorded on X in the last 24 hours, indicating rapid information spread, though these posts do not constitute verified sources of additional technical data.

Immediate actions: verify all corporate WordPress sites for SimpleForm plugin presence and check installed versions. Update the plugin as soon as an official patch is available from the vendor. In the meantime, disable or remove the plugin from affected sites. If deactivation is not feasible, restrict access to impacted forms to known corporate IP addresses using application firewall or WAF. Implement active monitoring on upload logs and file system anomalies. Retroactively verify access logs and file systems to determine if the form was exploited before the vulnerability was discovered.

At a glance

What: CVE-2026-118235 is an arbitrary file upload vulnerability in the SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications plugin for WordPress versions up to 3.10.2. The handle_upload function lacks a server-side file extension allowlist and does not properly sanitize extension derivation, allowing trailing-dot filenames to bypass all extension and MIME validations.
Severity: CVSS 9.8 (Critical). Maximum risk stems from exploitability by unauthenticated attackers: access control is a nonce printed publicly in the data-nonce attribute of every form embedded via shortcode, trivially obtainable by any visitor.
Affected versions: SimpleForm ≤ 3.10.2
Fix: Update to version later than 3.10.2 once available from vendor. Contact SimpleForm maintainer for official patches.
Status: Published by NVD on 2026-10-31. Four mentions recorded on X in the last 24 hours. It is not reported whether public exploits are available or if the CVE is actively exploited.
Action: Inventory WordPress sites with SimpleForm installed and check versions. Disable the plugin until patch is available. If not feasible, restrict form access with firewall rules to known IPs. Monitor upload logs and file system anomalies. Verify retroactively if forms were exploited.

Sources: NVD, CVE-2026-118235

← All articles